A suspected China-aligned threat group, tracked by researchers as UNK_MassTraction, has been actively exploiting vulnerabilities in Roundcube webmail servers to gain access to academic institutions in the United States and Canada. The primary targets appear to be physics and engineering departments, with potential connections to national security interests.
The attackers leveraged multiple known vulnerabilities in Roundcube to compromise these mail servers. Proofpoint, a cybersecurity firm that published research on the activity on June 7, observed that the threat group used these compromised servers not just for email data theft, but as an entry point into victim networks. This aligns with a broader trend of China-aligned operators exploiting internet-facing infrastructure, including edge devices and public applications, to achieve initial network access.
One key method employed by UNK_MassTraction involved phishing emails containing malicious content designed to exploit CVE-2024-42009, a cross-site scripting (XSS) vulnerability within Roundcube. When a user interacted with a vulnerable webmail client, this exploit allowed malicious JavaScript to execute within their browser. This JavaScript payload, identified by Proofpoint as IceCube, was designed to steal sensitive information such as usernames, passwords, cookies, and authentication data. The malware also collected environmental information from the victim's system, and the stolen session data was then used to facilitate further compromise.
Following the initial compromise of the Roundcube server, the threat actors exploited another vulnerability, CVE-2025-49113, which is described as a deserialization vulnerability. This allowed them to deploy a webshell for remote access or install the VShell backdoor directly into the server's memory. VShell is a publicly available remote access tool written in Go, and Proofpoint noted its previous use by China-aligned threat actors across Windows, Linux, and macOS environments.
The VShell backdoor provides attackers with interactive shell access and port-forwarding capabilities, enabling them to move laterally and deepen their presence within the compromised networks. Researchers assessed that the targeting strategy, infrastructure connections, and the presence of Chinese language artifacts in some phishing emails strongly suggest that UNK_MassTraction's operations are focused on espionage.
Proofpoint's analysis indicates that the attackers employed a range of techniques throughout the infection chain. These included credential theft via malicious JavaScript, server-side exploitation of vulnerable Roundcube components, deployment of webshells for persistent access, and memory-based execution of the VShell backdoor to evade detection.
The campaign serves as a reminder that email servers, like other internet-facing devices, remain attractive targets for threat actors. China-aligned operators, in particular, continue to treat these systems as critical entry points for network compromise.
Defenders are advised to prioritize the security of their mail servers with the same rigor applied to other remote access nodes, such as VPN concentrators. This includes ensuring that all software, including webmail applications like Roundcube, is kept up-to-date with the latest security patches to mitigate known vulnerabilities.
